diff options
| -rw-r--r-- | ChangeLog | 7 | ||||
| -rw-r--r-- | lib/rubygems.rb | 2 | ||||
| -rw-r--r-- | lib/rubygems/remote_fetcher.rb | 8 | ||||
| -rw-r--r-- | test/rubygems/test_gem_remote_fetcher.rb | 48 | ||||
| -rw-r--r-- | version.h | 2 |
5 files changed, 62 insertions, 5 deletions
@@ -1,3 +1,10 @@ +Mon Aug 17 23:07:47 2015 SHIBATA Hiroshi <hsbt@ruby-lang.org> + + * lib/rubygems.rb: bump version to 2.4.5.1. this version fixed + CVE-2015-3900. + * lib/rubygems/remote_fetcher.rb: ditto. + * test/rubygems/test_gem_remote_fetcher.rb: added testcase for CVE-2015-3900 + Mon Aug 17 23:00:56 2015 Nobuyoshi Nakada <nobu@ruby-lang.org> * ext/win32/lib/win32/registry.rb (API#SetValue): data size should diff --git a/lib/rubygems.rb b/lib/rubygems.rb index 05690c83f9..98e7dfaf82 100644 --- a/lib/rubygems.rb +++ b/lib/rubygems.rb @@ -9,7 +9,7 @@ require 'rbconfig' require 'thread' module Gem - VERSION = '2.4.5' + VERSION = '2.4.5.1' end # Must be first since it unloads the prelude from 1.9.2 diff --git a/lib/rubygems/remote_fetcher.rb b/lib/rubygems/remote_fetcher.rb index d42a7bd9de..b1f6dd17fc 100644 --- a/lib/rubygems/remote_fetcher.rb +++ b/lib/rubygems/remote_fetcher.rb @@ -94,7 +94,13 @@ class Gem::RemoteFetcher rescue Resolv::ResolvError uri else - URI.parse "#{uri.scheme}://#{res.target}#{uri.path}" + target = res.target.to_s.strip + + if /\.#{Regexp.quote(host)}\z/ =~ target + return URI.parse "#{uri.scheme}://#{target}#{uri.path}" + end + + uri end end diff --git a/test/rubygems/test_gem_remote_fetcher.rb b/test/rubygems/test_gem_remote_fetcher.rb index 74c52b69d6..63dd8feb38 100644 --- a/test/rubygems/test_gem_remote_fetcher.rb +++ b/test/rubygems/test_gem_remote_fetcher.rb @@ -167,6 +167,21 @@ gems: end def test_api_endpoint + uri = URI.parse "http://example.com/foo" + target = MiniTest::Mock.new + target.expect :target, "gems.example.com" + + dns = MiniTest::Mock.new + dns.expect :getresource, target, [String, Object] + + fetch = Gem::RemoteFetcher.new nil, dns + assert_equal URI.parse("http://gems.example.com/foo"), fetch.api_endpoint(uri) + + target.verify + dns.verify + end + + def test_api_endpoint_ignores_trans_domain_values uri = URI.parse "http://gems.example.com/foo" target = MiniTest::Mock.new target.expect :target, "blah.com" @@ -175,8 +190,37 @@ gems: dns.expect :getresource, target, [String, Object] fetch = Gem::RemoteFetcher.new nil, dns - @fetcher = fetcher - assert_equal URI.parse("http://blah.com/foo"), fetch.api_endpoint(uri) + assert_equal URI.parse("http://gems.example.com/foo"), fetch.api_endpoint(uri) + + target.verify + dns.verify + end + + def test_api_endpoint_ignores_trans_domain_values_that_starts_with_original + uri = URI.parse "http://example.com/foo" + target = MiniTest::Mock.new + target.expect :target, "example.combadguy.com" + + dns = MiniTest::Mock.new + dns.expect :getresource, target, [String, Object] + + fetch = Gem::RemoteFetcher.new nil, dns + assert_equal URI.parse("http://example.com/foo"), fetch.api_endpoint(uri) + + target.verify + dns.verify + end + + def test_api_endpoint_ignores_trans_domain_values_that_end_with_original + uri = URI.parse "http://example.com/foo" + target = MiniTest::Mock.new + target.expect :target, "badexample.com" + + dns = MiniTest::Mock.new + dns.expect :getresource, target, [String, Object] + + fetch = Gem::RemoteFetcher.new nil, dns + assert_equal URI.parse("http://example.com/foo"), fetch.api_endpoint(uri) target.verify dns.verify @@ -1,6 +1,6 @@ #define RUBY_VERSION "2.2.3" #define RUBY_RELEASE_DATE "2015-08-17" -#define RUBY_PATCHLEVEL 170 +#define RUBY_PATCHLEVEL 171 #define RUBY_RELEASE_YEAR 2015 #define RUBY_RELEASE_MONTH 8 |